A security analyst is reviewing the results of an SCA scan for a Java application. The scan reports a critical vulnerability in a library that is used only in the test suite. The application is scheduled for release next week. What should the analyst do?

Ignore the finding because the vulnerable library is only used in tests and does not affect the production application.

Remove the test suite from the repository to eliminate the vulnerable library.

Add the library to the SCA scanner's allowlist to suppress the finding.

Update the library to a patched version and verify that the test suite still passes.

Which of the following is a typical scope of repository scanning?

Source code, configuration files, and dependency manifests

Only the production environment's runtime logs

Only the source code of the application

Only the secrets and credentials stored in the repository

Which file would an SCA scanner typically analyze to identify open-source dependencies?

A package manifest file such as package.json or requirements.txt

A configuration file for the CI/CD pipeline

A cloud formation template defining infrastructure

A Dockerfile used to build a container image

A cloud security engineer is configuring IaC drift detection for a Kubernetes cluster that is managed using Helm charts. The engineer wants to be alerted when the deployed cluster configuration differs from the Helm chart definitions. Which configuration is most appropriate?

Enable secrets scanning on the Helm chart repository to detect any hardcoded credentials.

Configure SCA scanning to identify vulnerabilities in the Helm chart dependencies.

Enable drift detection and configure it to compare the Helm chart values with the live cluster state on a regular schedule.

Set up a manual process to run 'helm diff' and compare the output with the current cluster state.

Palo Alto NetworksCertified Cloud Security Engineer

Domain 5Objective 3

5.3 Explain the Configuration and Management of Repository Scanning (e.g., Infrastructure as Code [IaC], Secrets, SCA, IaC Drift Detection) CLOUD-SECURITY-ENGINEER Practice Questions (Page 5)

Part of the Application Security domain, which accounts for 16% of the CLOUD-SECURITY-ENGINEER exam.

24questions here

5free pages

6concepts

16%of the exam

Questions 21–24

21application · medium
A security analyst is reviewing the results of an SCA scan for a Java application. The scan reports a critical vulnerability in a library that is used only in the test suite. The application is scheduled for release next week. What should the analyst do?
Select an answer first
22foundation · easy
Which of the following is a typical scope of repository scanning?
Select an answer first
23foundation · easy
Which file would an SCA scanner typically analyze to identify open-source dependencies?
Select an answer first
24application · medium
A cloud security engineer is configuring IaC drift detection for a Kubernetes cluster that is managed using Helm charts. The engineer wants to be alerted when the deployed cluster configuration differs from the Helm chart definitions. Which configuration is most appropriate?
Select an answer first

Finished these 4 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to CLOUD-SECURITY-ENGINEER

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Palo Alto Networks. “CLOUD-SECURITY-ENGINEER” is a trademark of its owner, used for identification only.